{"cve":"CVE-2005-2640","nvd":{"published":"2005-08-23T04:00:00.000","modified":"2026-06-16T22:15:23.250","status":"Modified","description":"Behavioral discrepancy information leak in Juniper Netscreen VPN running ScreenOS 5.2.0 and earlier, when using IKE with pre-shared key authentication, allows remote attackers to enumerate valid usernames via an IKE Aggressive Mode packet, which generates a response if the username is valid but does not respond when the username is invalid.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["http://marc.info/?l=bugtraq&m=112438068426034&w=2","http://secunia.com/advisories/16474/","http://securitytracker.com/id?1014728","http://www.nta-monitor.com/news/vpn-flaws/juniper/netscreen/index.htm","http://www.securityfocus.com/bid/14595"],"products":["juniper:netscreen-5gt","juniper:netscreen-idp","juniper:netscreen-idp_10","juniper:netscreen-idp_100","juniper:netscreen-idp_1000","juniper:netscreen-idp_500","juniper:netscreen_screenos","neoteris:instant_virtual_extranet","netscreen:netscreen-sa_5000_series","netscreen:netscreen-sa_5020_series","netscreen:netscreen-sa_5050_series","netscreen:ns-10","netscreen:ns-100","netscreen:ns-204","netscreen:ns-500","netscreen:ns-50ns25"],"source":"nvd","synced_at":"2026-10-19T19:39:29.870204089+00:00"},"epss":{"cve":"CVE-2005-2640","score":0.07093,"percentile":0.94231,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}